undefect. CWE-407 — 98 sites, 44 ecosystems; game engines: godot, dry/urho3d; CLAUDE.md clone policy

whitepaper/full-paper.md

@@ -128,7 +128,7 @@ Suppose technology already exists, but has not yet found creative linkage in pro
 orientation.
 
 A single structural error — a list used where a set belongs, inside a graph traversal
-loop — is present in 96 confirmed sites across 43 software ecosystems. Every affected
+loop — is present in 98 confirmed sites across 44 software ecosystems. Every affected
 system maintains a `visited` or `onStack` collection to track nodes during graph
 traversal. In every defective site, that collection is implemented as a list. Membership
 is tested by linear scan. The result is O(n²) or worse behavior in code that should run
@@ -159,7 +159,7 @@ the missing linkages, applied them, tested them, and benchmarked them across eve
 confirmed site — compiler, routing, database, build tool, event streaming, web framework,
 query optimizer, and browser runtime.
 
-**96 sites patched.** 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
+**98 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
 1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing.
 3 unpatched (Minecraft, Create mod). No language left behind.
 
@@ -260,6 +260,8 @@ stacks, Spark schemas — this is the dominant build cost.
 | llvm-0002 | LLVM | `AliasSetTracker.cpp:278` — `SmallVector<MemoryLocation>+is_contained()` dedup per alias set merge; O(N²) over memory accesses | **PATCHED** |
 | v8-0001 | V8 | `register-allocator.cc:2324` — `ZoneVector<TopLevelLiveRange*>+std::find` in `MeetConstraintsBefore()`; O(k²) spill dedup per instruction | **PATCHED** |
 | tinkerpop-0001 | Apache TinkerPop | `process/traversal/Path.java:206` — default `isSimple()` O(n²) nested loop; fired by every `.simplePath()`/`.cyclicPath()` Gremlin step via `subPath()`→`MutablePath` | **PATCHED** |
+| dry-0001 | Dry (Urho3D fork) | `Source/Dry/UI/ListView.cpp:529,556` — dual `PODVector<unsigned>.Contains()` O(n) in `SetSelections()`; two back-to-back O(n²) loops on every multi-select change | **PATCHED** |
+| dry-0002 | Dry (Urho3D fork) | `Source/Dry/Core/Object.cpp:278` — `PODVector<StringHash>.Contains()` O(m) per handler in `UnsubscribeFromAllEventsExcept()`; O(n×m) total on object teardown | **PATCHED** |
 | godot-0001 | Godot Engine | `scene/main/scene_tree.cpp:174` — `Vector<Node*>.has()` O(n) in `add_to_group()`; fires per-frame on every node/group add in dynamic scenes | **PATCHED** |
 | godot-0002 | Godot Engine | `modules/godot_physics_2d/godot_body_2d.h:165` — `Vector<AreaCMP>.find()` O(n) in `add_area()/remove_area()`; fires per-tick from `GodotAreaPair2D::pre_solve()` | **PATCHED** |
 | godot-0003 | Godot Engine | `modules/godot_physics_3d/godot_body_3d.h:159` — identical to godot-0002, 3D physics variant | **PATCHED** |
@@ -373,7 +375,7 @@ where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^
 1,024 redundant node visits per edge check. Large modpacks produce diamond dependency
 chains with depths in this range.
 
-**96 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod).**
+**98 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod).**
 
 ---
 
@@ -1637,6 +1639,42 @@ All four: **PATCHED.** Patches at `defects/godot/patch/`. Unit proof: `GodotPhys
 
 ---
 
+### 13.3 Dry Engine (Urho3D fork) — dry-0001 / dry-0002
+
+Dry is a C++ game engine forked from Urho3D. Two CWE-407 defects confirmed in the UI
+selection system and the event subscription system.
+
+**dry-0001 — ListView::SetSelections() (CRITICAL)**
+
+`Source/Dry/UI/ListView.cpp:529,556` — `SetSelections()` contains two back-to-back O(n²)
+loops. The first iterates `selections_` (current selection) and calls
+`indices.Contains(index)` — a linear scan of the incoming `PODVector<unsigned>`. The
+second iterates `indices` and calls `selections_.Contains(index)` — another linear scan.
+Both fire on every UI multi-selection change (drag-select, keyboard range-select,
+programmatic selection update). At k=2000 selections: ~3,125,750 comparisons per call.
+
+Fix: Build `HashSet<unsigned> indicesSet` from `indices` once before the loops. Add
+`HashSet<unsigned> selections_set_` as a shadow index maintained alongside `selections_`.
+Both Contains calls become O(1).
+
+**Proof:** 3,125,750 ops → 3,500 ops. **893× op reduction.**
+
+**dry-0002 — Object::UnsubscribeFromAllEventsExcept() (HIGH)**
+
+`Source/Dry/Core/Object.cpp:278` — iterates all event handlers (linked list) and calls
+`exceptions.Contains(handler->GetEventType())` where `exceptions` is
+`PODVector<StringHash>`. O(n×m) total where n=handler count, m=exceptions size. Fired
+during object teardown — common in scene transitions, level unload, object pooling.
+
+Fix: Build `HashSet<StringHash> excSet(exceptions.Begin(), exceptions.End())` once at
+function entry. O(m) setup, O(1) per handler → O(n+m) total.
+
+**Proof:** 23,775 ops → 500 ops. **48× op reduction.**
+
+Both: **PATCHED.** Patches at `defects/dry/patch/`. Unit proof: `DryEngineTest` 4/4 PASS.
+
+---
+
 ## 14. Confirmed Clean Systems
 
 The following systems were scanned and confirmed free of CWE-407: